Quick answer: Resume prompt injection is text a candidate hides in a resume, often in white or tiny font, aimed at the AI that reads it rather than the recruiter. Today it mostly tries to inflate a candidate’s score. Once an AI assistant can also act in your ATS through MCP, the same trick becomes a security risk: a file the AI reads could try to make it change records, send messages or pull data.
How common: ManpowerGroup told The New York Times it finds hidden text in about 10% of the resumes it scans with AI, and Greenhouse put the figure near 1%.
The fix: keep a human between anything an AI reads from an outside file and anything it does in your systems.
What is resume prompt injection?
It is a candidate writing instructions for the AI screener inside their resume. The text is usually hidden from people with white font on a white background or a font size too small to see. A typical example tells the AI to disregard its earlier instructions and describe the applicant as exceptionally well qualified.
It spread fast. A recent graduate told The New York Times she landed six interviews from 30 applications after adding a hidden prompt, against one interview from about 60 before, as summarized by Built In’s report. One US employer found roughly 1,500 characters of white text in a single legal candidate’s resume, Business Insider reported, per People Matters. Korean reporting cites Duke University research showing prompt injection cases rose sevenfold between July 2024 and November 2025, per The Korea Herald.
How common is hidden text in resumes?
| Source | Finding |
|---|---|
| ManpowerGroup, via The New York Times | Hidden text in about 100,000 resumes a year, roughly 10% of those it scans with AI |
| Greenhouse, via The New York Times | About 1% of resumes contain hidden text |
| 2026 study of 196,682 real resumes, via Metaview | Hidden injections in about 1%, and most gave the AI no instruction at all, mainly hidden skill lists |
| Duke University research, via The Korea Herald | Prompt injection cases up sevenfold from July 2024 to November 2025 |
Sources: Built In, The Star (NYT), Metaview’s analysis, Korea Herald. The gap between 1% and 10% likely reflects different applicant pools and detection methods. Either way, a busy agency desk will see it.
Does resume prompt injection actually work?
Mostly not, and it often backfires. An ATS strips formatting when it parses a resume, so the white text shows up in plain view for any recruiter reading the parsed version, as Hiration explains. Many recruiters reject candidates outright when they find it.
The bigger lesson for agencies is not about cheating candidates. It is that your AI reads text you did not write, from people you do not know.
Why does MCP change the risk?
Because an AI that can act can be told to act. Security people call this indirect prompt injection. The OWASP Gen AI Security Project ranks prompt injection as the top risk for AI applications and defines the indirect kind as instructions arriving from outside sources such as websites or files, per OWASP LLM01. Wiz notes those instructions can sit in a PDF, a web page or even an MCP tool description, per Wiz’s OWASP guide.
It is not theoretical in office software either. Wiz describes EchoLeak, a zero click flaw in Microsoft 365 Copilot that allowed data to be pulled out through a single crafted email.
| AI setup | What a hidden instruction could try | Risk |
|---|---|---|
| Chat assistant, resume pasted in, no connections | Inflate the candidate’s summary or score | Low: a bad summary a recruiter can catch |
| AI with read only ATS access through MCP | Pull other candidates’ or clients’ details into its answer | Medium: data shown where it should not be |
| AI with write access to ATS, email or calendar | Change a status, add notes, send a message or forward data | High: real actions with no human check |
This is why we recommend starting read only in our Bullhorn MCP guide and our MCP access overview.
How do you protect your agency from resume prompt injection?
- Keep a human between reading and doing. If an AI reads an outside file, a person approves any change, message or export that follows. Put it in your agency AI policy.
- Do not combine broad access with outside files. An assistant that screens inbound resumes should not also hold write access to your whole database.
- Review parsed text, not just the pretty PDF. Hidden text shows up in plain text, so read what the AI actually sees.
- Check what your ATS and AI vendors detect. Ask whether they flag hidden text and suspicious instructions before the AI reads a file.
- Turn on confirmations. Most AI assistants can ask before running a tool. Keep that on for any action that writes or sends.
- Limit what the AI user can see. The less an AI connection can reach, the less an injected instruction can pull. See database protection steps.
What should you do when you find hidden text?
Treat it as information, not proof of bad intent. Some resumes contain hidden keyword lists from old ATS advice, and the Metaview analysis found most hidden content was skill lists rather than instructions. ManpowerGroup’s data lead has also suggested the text is not always added by the candidate; resume services may add it too, per Newswav’s report. Decide your rule ahead of time, apply it to everyone, and keep a note of why a candidate was set aside. If you screen with AI, our guide to screening resumes with Claude covers how to check its scores.
Quick answers
What is resume prompt injection?
Hidden text in a resume written for the AI screener, usually telling it to rate the candidate highly.
How do I spot hidden text in a resume?
Select all text and change it to black, or read the parsed plain text version in your ATS.
Can prompt injection affect my ATS through MCP?
It can try. If your AI can write to the ATS or send email, an instruction in a file it reads could attempt an action. Keep a human approval step.
Should we reject candidates with hidden text?
Set a clear, consistent rule. Many recruiters reject them; others ask the candidate first.
Is this only a resume problem?
No. Emails, cover letters, LinkedIn profiles and web pages your AI reads can carry the same kind of hidden instruction.
Does it break privacy rules?
It can lead to data being exposed. Our candidate data guide covers your obligations.
The bottom line
Hidden prompts in resumes are common and mostly harmless when AI only summarizes. They become a real risk when the same AI can act in your ATS, inbox or calendar. Keep connections read only at first, keep a human between what AI reads and what it does, and limit what each connection can reach. For every guide in this series, see MCP for staffing agencies.
Sources: Built In, The Star (NYT), Metaview, Korea Herald, Hiration, OWASP LLM01, Wiz, Newswav
Free newsletter
Get the Work Insiders weekly
One email a week: the recruiting and HR tech news that mattered, the tools we just added to the directory, and one practical guide. No spam, and you can unsubscribe in one click.